SSH: keys, ssh-copy-id and hardening sshd

How key login works

A key pair is two linked files. The private key stays on your laptop and must never be shared. The public key can be given to anyone; you put it in ~/.ssh/authorized_keys on every server you want to log into. When you connect, the server sends a challenge that only the matching private key can answer. No password crosses the network, and a stolen public key is useless.

Making and installing a key

[asha@laptop ~]$ ssh-keygen -t ed25519 -C "asha@laptop"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/asha/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Your identification has been saved in /home/asha/.ssh/id_ed25519
Your public key has been saved in /home/asha/.ssh/id_ed25519.pub
[asha@laptop ~]$ ssh-copy-id asha@web01.example.com
asha@web01.example.com's password:
Number of key(s) added: 1
[asha@laptop ~]$ ssh asha@web01.example.com
[asha@web01 ~]$

ssh-copy-id appends your .pub file to ~/.ssh/authorized_keys on the server and sets safe permissions. Done by hand, the rules are strict: ~/.ssh must be 700 and authorized_keys 600, owned by the user, or sshd ignores the key. On RHEL the files also need the right SELinux label (ssh_home_t); restorecon -Rv ~/.ssh fixes that if you created them oddly.

Useful client features

$ ssh -i ~/.ssh/deploy_key deploy@203.0.113.10      # a specific key
$ scp report.pdf asha@web01:/tmp/                      # copy a file over SSH
$ rsync -avz ./site/ asha@web01:/var/www/html/         # sync a folder (needs rsync on both sides)
$ cat ~/.ssh/config
Host web01
    HostName web01.example.com
    User asha
    IdentityFile ~/.ssh/id_ed25519
$ ssh web01                                            # uses the settings above

Hardening the server

The SSH server is sshd, configured in /etc/ssh/sshd_config. On RHEL 9 that file starts with Include /etc/ssh/sshd_config.d/*.conf, and for each setting sshd uses the FIRST value it reads. So the cleanest way to change settings is a drop-in file whose name sorts early, which wins over later lines.

# /etc/ssh/sshd_config.d/01-hardening.conf
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowGroups sshusers

# sshd -t                         # syntax test; no output means OK
# sshd -T | grep -Ei 'permitrootlogin|passwordauthentication'
permitrootlogin no
passwordauthentication no
# systemctl reload sshd
$ ssh asha@web01                  # test in a NEW terminal before closing the old one

On RHEL 9 the default already blocks root logins with a password (PermitRootLogin prohibit-password). Setting it to no blocks root over SSH entirely; admins log in as themselves and use sudo.

Common mistakes

• Wrong permissions on ~/.ssh or authorized_keys: the server falls back to asking for a password. Check /var/log/secure for "Authentication refused: bad ownership or modes".
• Copying the PRIVATE key to the server. Only the .pub file goes there.
• Editing sshd_config but a drop-in file read earlier sets the same option, so your change has no effect. Check with sshd -T.
• Disabling passwords before keys work for all admins, and locking everyone out.